boogled/node-js repository overview

This is a simple Node app that is vulnerable to command injection via a flawed use of the eval statement.

You can set this up using docker as:

docker run -p 8000:8080 -d boogled/node-js

Exploit the RCE

#Docker-compose file for insecure volume mount:

version: '2.2'

services:

node:

image: boogled/node-js:0.2 

container_name: Insecure_Volume_Mount

volumes:

  - /var/run/docker.sock:/var/run/docker.sock

ports:

  - 8000:8080

Exploit the RCE to get the shell

Inside the Container check for ls -l /var/run/docker.sock mount

Exploit container to get the host privilege (For this one need to install docker client on the container)